--- title: IMAP, POP3 and email round-trip monitors, and SMTP login checks description: Your mail server can answer every check while nobody can log in, or your password-reset email never arrives. New IMAP and POP3 monitors log in to a mailbox… canonical: https://watchfor.io/changelog/2026-10-04-email-monitors --- [All updates](/changelog#2026-10-04-email-monitors) ✨ New Email Oct 4, 2026 · v 9.3.3 # IMAP, POP3 and email round-trip monitors, and SMTP login checks Your mail server can answer every check while nobody can log in, or your password-reset email never arrives. New IMAP and POP3 monitors log in to a mailbox and check TLS, the certificate and whether new mail still arrives. The email round-trip monitor sends a test message through your SMTP server, finds it in the mailbox and reports delivery time, Inbox or Spam and SPF, DKIM and DMARC. SMTP monitors can now log in on 587 or 465. On Pro and Business. ## IMAP and POP3 Each check does what a mail client does: connects with implicit TLS (993 / 995) or STARTTLS (143 / 110), verifies the certificate and counts its days left, reads the capabilities, logs in and reads the mailbox. IMAP opens the mailbox read-only and lists the folders; POP3 reads the message count and mailbox size without downloading anything. Every stage is timed separately, and each result gets a mail server grade from A+ to F with the reasons listed. - Login Failed and Certificate Expiry are on from the start. - No New Mail alerts when the newest message is older than you expect. Only its date is read, never a subject, sender or body. - Plaintext Login Offered and STARTTLS Not Offered catch servers that would let a client send its password unencrypted. - Without a username, the check covers the connection, TLS and capabilities. ## Email round-trip At most every 5 minutes, the monitor logs in to your SMTP server on 587 or 465, sends a short message with a fixed subject ("WatchFor delivery check" and a token) and looks for it in the mailbox over IMAP or POP3. It reports how long delivery took, whether the message landed in the Inbox or the spam folder (IMAP), the SPF, DKIM and DMARC verdict the receiving server wrote, the spam score and antivirus headers when the filter leaves them, and every relay hop with its delay and TLS. Then it deletes the message. Message Not Delivered and Landed in Spam are on from the start; slow delivery, SPF, DKIM or DMARC failures and unencrypted hops are ready to turn on. ## SMTP login checks Turn on Authenticate on an SMTP monitor to log in with the account your apps send from, on 587 (STARTTLS) or 465 (implicit TLS), after TLS is up. The check also verifies the certificate. Port 25 is never used for logging in. ## Credentials Mailbox passwords are encrypted at rest, tied to the monitor they belong to and never shown again: not in the dashboard, the API, MCP, exports, check results or logs. Gmail needs an [app password](https://support.google.com/accounts/answer/185833). Microsoft 365 has turned off password logins for IMAP and POP3, and OAuth sign-in isn't supported yet. More: [IMAP](/imap-monitoring), [POP3](/pop3-monitoring) and [email round-trip](/email-round-trip-monitoring) monitoring, and the [docs](/docs/monitors/email-round-trip). Share this update --- Canonical page: https://watchfor.io/changelog/2026-10-04-email-monitors · Site guide: https://watchfor.io/llms.txt